one command
a single container runs a full kubernetes in-process, and the operator brings the platform up on it: portal, web, catalog, streaming. one image, one port (80), linux/amd64; the first boot pulls the rest from ghcr.io.
> neutral · self-hosted media platform pre-release
your media.
your server.
bring your own files; zaentrum catalogs, processes, and streams them to clean clients on the web, your phone, and your tv. one command to run — and it never acquires content.
$ docker run -d --privileged --restart unless-stopped \ -p 80:80 --name zaentrum ghcr.io/zaentrum/appliance:latest $ open http://zaentrum.localhost
> you own your library
zaentrum is content-neutral. you point it at files that are already on disk; it catalogs and streams them. there are no built-in downloaders and no indexer integrations — how the files got there is out of scope, by design.
> the platform
roughly sixteen services — one image on your laptop, or a full cluster. same manifests, either way.
bundled backends
keycloak, postgres, valkey and a kafka broker run inside the container. nothing external to stand up before you can browse your first title.
event-driven pipeline
scan → enrich → analyze → transcode → package. every stage handoff is a kafka event keyed by item. optional gpu (nvenc) acceleration; software by default. a cluster option (features.pipeline): the appliance streams files as they are.
clean clients
web, phone/tablet and tv — skins over one shared core. point any of them at your server with add server, over https with a certificate the device trusts: sign-in works over plain http on localhost only, and the phone and tv apps refuse http.
scales out
the same platform runs on any kubernetes cluster, reconciled by an operator from a single custom resource — with day-2 scaling, and new images rolled as they are published. release channels: stable follows the tagged releases, edge the newest build.
your identity
run the bundled keycloak, or point a cluster install at your own oidc provider (identity.mode: external). federating your provider through keycloak is designed, not built yet.
> one core, many skins
chino
video
live
tv
live tv
planned
musig
music
planned
> get started
two paths, same platform. start on your laptop; move to a cluster when you outgrow it.
one box
everything in a single container, on linux/amd64.
$ docker run -d --privileged \ --restart unless-stopped -p 80:80 \ --name zaentrum \ ghcr.io/zaentrum/appliance:latest $ open http://zaentrum.localhost
sign in as admin with the one-time password the install generates
(docker exec zaentrum kubectl -n zaentrum get secret zaentrum-keycloak-admin -o jsonpath='{.data.realm-admin-password}' | base64 -d),
and the setup checklist on the launchpad walks you through the rest: a tmdb key, your
files, a scan.
it serves this machine only: other devices need https.
first run →
on kubernetes
the same platform, operator-managed.
$ base=https://raw.githubusercontent.com/zaentrum $ kubectl apply -f \ $base/zaentrum-operator/main/deploy/operator-install.yaml $ kubectl create namespace zaentrum $ kubectl apply -f zaentrum.yaml # your Zaentrum CR
the install manifest pins the operator to one build; applying it is a one-time cluster-admin step. one operator reconciles ~16 services from one custom resource. operator & cr reference →
> the full manual lives in the wiki
deployment and operations, by audience — prerequisites, self-hosting, the operator and every Zaentrum field, a worked demo, day-2 updates, and troubleshooting.